CVE-2016-2510
Improper Input Validation in BeanShell
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
- Record
CVE-2016-2510- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-19
- Updated
- 2026-11-02
CVE List No score
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
- Record
CVE-2016-2510- Updated
- 2026-11-02
EUVDEUVD-2022-4031 No score
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
- Record
EUVD-2022-4031- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gxg6-rc6c-v673
Improper Input Validation in BeanShell
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
- Record
GHSA-gxg6-rc6c-v673- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
- Record
CVE-2016-2510- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-2510
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
- Record
DEBIAN-CVE-2016-2510- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-gxg6-rc6c-v673
Improper Input Validation in BeanShell
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
- Record
GHSA-gxg6-rc6c-v673- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-2510
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
- Record
UBUNTU-CVE-2016-2510- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10420-1 No score
bsh2-2.0.0.b6-2.7 on GA media
These are all security issues fixed in the bsh2-2.0.0.b6-2.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10420-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0699-1 No score
Security update for bsh2
This update for bsh2 fixes the following issue:
- CVE-2016-2510: An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source.
Please see https://github.com/beanshell/beanshell/releases/tag/2.0b6 for more information.
- Record
SUSE-SU-2016:0699-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0700-1 No score
Security update for bsh2
This update for bsh2 fixes the following issues:
- CVE-2016-2510: An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source.
Please see https://github.com/beanshell/beanshell/releases/tag/2.0b6 for more information.
- Record
SUSE-SU-2016:0700-1- Updated
- 2026-11-02
OSVUSN-2923-1 No score
bsh vulnerability
Alvaro Muñoz and Christian Schneider discovered that BeanShell incorrectly handled deserialization. A remote attacker could possibly use this issue to execute arbitrary code.
- Record
USN-2923-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache-extras.beanshell:bshMaven |
through 2.0b5 | 2.0b6 |
bshDebian:12 |
before 2.0b4-16 | 2.0b4-16 |
bshDebian:13 |
before 2.0b4-16 | 2.0b4-16 |
bshDebian:14 |
before 2.0b4-16 | 2.0b4-16 |
bshDebian:6.0 |
before 2.0b4-12+deb6u1, plus listed versions 2.0b4-12 |
2.0b4-12+deb6u1 |
bshDebian:7 |
before 2.0b4-12+deb7u1, plus listed versions 2.0b4-12 |
2.0b4-12+deb7u1 |
bshDebian:8 |
before 2.0b4-15+deb8u1, plus listed versions 2.0b4-15 |
2.0b4-15+deb8u1 |
org.apache-extras.beanshell:bshMaven |
before 2.0b6, plus listed versions 2.0b5 |
2.0b6 |
bsh2SUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.0-318.1 | 2.0-318.1 |
bsh2SUSE:Linux Enterprise Software Development Kit 12 |
before 2.0.0.b5-3.2 | 2.0.0.b5-3.2 |
bsh2SUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 2.0.0.b5-3.2 | 2.0.0.b5-3.2 |
bshUbuntu:14.04:LTS |
before 2.0b4-15ubuntu0.14.04.1, plus listed versions 2.0b4-12ubuntu12.0b4-15 |
2.0b4-15ubuntu0.14.04.1 |
bsh2openSUSE:Tumbleweed |
before 2.0.0.b6-2.7 | 2.0.0.b6-2.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-2510 is a high vulnerability (CVSS 8.1) in Beanshell, published February 19, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 70.4%, the 99th percentile. Fixed in org.apache-extras.beanshell:bsh 2.0b6.
References
rhn.redhat.com/errata/RHSA-2016-2035.html
securityfocus.com/bid/84139
access.redhat.com/errata/RHSA-2016:1135
lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html
Show 23 moreShow less
debian.org/security/2016/dsa-3504
securitytracker.com/id/1035440
ubuntu.com/usn/USN-2923-1
security.gentoo.org/glsa/201607-17
oracle.com/security-alerts/cpuoct2020.html
github.com/frohoff/ysoserial/pull/13
rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf
nvd.nist.gov/vuln/detail/CVE-2016-2510
security-tracker.debian.org/tracker/CVE-2016-2510
suse.com/support/update/announcement/2016/suse-su-20160699-1
bugzilla.suse.com/967593
ubuntu.com/security/CVE-2016-2510
cve.org/CVERecord?id=CVE-2016-2510